AgentFlows
ClaudePull requestNot executed

OWASP-focused security PR review

pull_request: opened, synchronize

`use_sticky_comment` keeps one updatable comment (usage.md).

Estimated cost per run

~$0.22

Estimated, not measured.

Basis. ASSUMPTION (6 runner min x $0.006/min GitHub-hosted Linux 2-core (docs.github.com/en/billing/reference/actions-runner-pricing)) + ASSUMED 70,000 input / 4,000 output tokens at Claude Sonnet 5 API $2/MTok in, $10/MTok out (platform.claude.com/docs/en/about-claude/pricing). Token counts are not measured; replace after a real test run.

Verification

Last checked Oct 16, 2026.

inputs checked against source docs; workflow not executed.

Source

No open caveats. The workflow still has not been executed.

Workflow YAML

Copy the file as-is. Highlighting is only for reading.

workflow.yml

name: Security Reviewon:  pull_request:    types: [opened, synchronize]jobs:  security:    runs-on: ubuntu-latest    permissions:      contents: read      pull-requests: write      id-token: write    steps:      - uses: actions/checkout@v6        with:          fetch-depth: 1      - uses: anthropics/claude-code-action@v1        with:          anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}          use_sticky_comment: true          prompt: |            REPO: ${{ github.repository }}            PR NUMBER: ${{ github.event.pull_request.number }}            Perform an OWASP Top 10 aligned security review. Rate each finding by severity.          claude_args: |            --allowedTools "mcp__github_inline_comment__create_inline_comment,Bash(gh pr comment:*),Bash(gh pr diff:*),Bash(gh pr view:*)"

More workflows

  • Claude01

    Claude auto PR review

    Copied from the official Solutions Guide basic example (prompt shortened).

    pull_request: opened, synchronize

    Estimated cost~$0.18

    Not executed

    Checked Oct 16, 2026

  • Claude02

    Claude PR review with progress tracking

    `track_progress: true` posts a checkbox tracking comment (per Solutions Guide).

    pull_request: opened, synchronize, ready_for_review, reopened

    Estimated cost~$0.22

    Not executed

    Checked Oct 16, 2026

  • Claude03

    @claude mention assistant on issues and PRs

    No `prompt` → the action runs in tag/interactive mode and responds to the comment. `trigger_phrase` default is `@claude` (usage.md).

    issue_comment / pull_request_review_comment containing @claude

    Estimated cost~$0.27

    Not executed· 1 caveat

    Checked Oct 16, 2026